1. Home
  2. CVE Database
  3. CVE-2023-3222
HIGH · 7.5

CVE-2023-3222

Vulnerability in the password recovery mechanism of Password Recovery plugin for Roundcube, in its 1.2 version, which could allow a remote attacker to change an existing user´s password by adding a 6-...

Vulnerability Description

Vulnerability in the password recovery mechanism of Password Recovery plugin for Roundcube, in its 1.2 version, which could allow a remote attacker to change an existing user´s password by adding a 6-digit numeric token. An attacker could create an automatic script to test all possible values because the platform has no limit on the number of requests.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
Password Recovery ProjectPassword Recovery1.2

Related Weaknesses (CWE)

CWE-640

References

FAQ

What is CVE-2023-3222?

CVE-2023-3222 is a vulnerability with a CVSS score of 7.5 (HIGH). Vulnerability in the password recovery mechanism of Password Recovery plugin for Roundcube, in its 1.2 version, which could allow a remote attacker to change an existing user´s password by adding a 6-...

How severe is CVE-2023-3222?

CVE-2023-3222 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-3222?

Check the references section above for vendor advisories and patch information. Affected products include: Password Recovery Project Password Recovery.